Former FBI Exec: Public Needs To Recognize Cyber Attacks Pose Grave Threat

Shawn Henry, formerly the FBI's assistant executive director, and currently president and CEO of Crowdstrike Services, said the potential of cyber attacks is not fully recognized and threatens us, "not just as a country; but as a global society."

Henry addressed a standing room only crowd of several hundred people Wednesday at the 15th annual Black Hat conference, under way in Las Vegas this week.

"The vast majority of what occurs out there is only known in the classified environment," Henry said. "What people hear and see on the news is just the tip of the iceberg."

[Related: 7 Security Threats Circling Your Network ]

"Cyber is the great equalizer," he continued. "Anybody with a $500 computer and an Internet connection can attack anyone at any time while sitting in their pajamas."

But Henry also pointed out that there are many similarities between threats in the physical world and threats in the cyber world because, while the methods may be different, the intentions, such as espionage and the attempt to steal money, are often very much the same.

Henry believes that security experts need to change their tactics in order to be successful. It's no longer sufficient to focus on the perimeter of the network. The new paradigm needs to be about understanding our enemies as well as our own organizations, he predicts.

"We can't be there to protect every company, every school, and every shopping mall," he said. "We need to evolve. After 9/11, the FBI transformed from a law enforcement mode in which we focused on criminal arrests towards a paradigm much more focused on national security."

The information security industry, he believes, needs to evolve, as well. And much of that involves proactive information gathering, preferably before the attack actually occurs.

"We are reacting too late. If we collect intelligence, we can get out in front. It's going to require some technical developments and policy changes, but I've seen us do this in the physical world. I believe we can do it in the cyber world."

Despite that expression of hopefulness, Henry also indicated that it might take a 9/11-scale event in the cyber world to get the general public to truly grasp the risks associated with breached information security.

"People will not truly get this until they see the real implications of a cyber attack," he said. "For example, people knew about Osama bin Laden prior to 9/11, but that awareness had risen by several orders of magnitude after the attacks. I believe something like that will have to happen in the cyber world before people truly get it."

PUBLISHED JULY 25